{{- /*
Placeholder Secret that reflector (bp-reflector) populates from the CNPG-
generated `harbor-pg-app` Secret.

Harbor upstream chart reads `database.external.existingSecret` expecting a
key `HARBOR_DATABASE_PASSWORD` in the named Secret. CNPG produces
`harbor-pg-app` with a `password` key. Two problems to bridge:
  1. Key name mismatch  (`password` vs `HARBOR_DATABASE_PASSWORD`)
  2. Timing: CNPG may not have provisioned `harbor-pg-app` when Helm renders
     (Helm `lookup` only works reliably for idempotent upgrades, not fresh
     installs where the Cluster boots after the chart is applied)

Solution: use the k8s-reflector (bp-reflector, slot 05a) to copy
`harbor-pg-app` into this Secret via the `reflects` annotation. The
`reflection-allowed` annotations on the SOURCE Secret (`harbor-pg-app`)
are stamped by CNPG at cluster bootstrap time via the `inheritedMetadata`
stanza in templates/cnpg-cluster.yaml. CNPG v1.24+ propagates
`inheritedMetadata.annotations` onto all Secrets it generates
(harbor-pg-app, harbor-pg-superuser, etc.) during initial creation AND
on every reconciliation pass. Once the source carries
`reflection-allowed: true`, Reflector propagates the full key set from
`harbor-pg-app` into `harbor-database-secret`, including `password` and
`HARBOR_DATABASE_PASSWORD`. Harbor core reads `HARBOR_DATABASE_PASSWORD`
from the secret on the next CrashLoop retry — typically within seconds
of Reflector firing.

CRITICAL — Helm pre-install hook (NOT a normal release resource):
  - `helm.sh/hook: pre-install` — Helm creates this Secret ONLY at
    install time. On `helm upgrade`, Helm does NOT touch the Secret at
    all (no three-way merge), so the keys Reflector populates persist
    across every chart version bump.
  - `helm.sh/hook-delete-policy: before-hook-creation` — On a re-install
    (e.g. after `helm uninstall` followed by `helm install`), Helm
    deletes the previous Secret first so the hook recreates a clean one.
    With `resource-policy: keep` below, `helm uninstall` does NOT delete
    the Secret, so the standard upgrade path never sees a delete.
  - Hook resources are NOT recorded in the Helm release manifest, so
    they're invisible to `helm upgrade`'s three-way merge.

Earlier attempts (1.2.5–1.2.7) tried `data: { password: "", ... }` and
then dropped the `data:` block entirely, but Helm still owns the Secret
under upgrade and resets its `data:` to nil on every chart bump.
The hook approach removes Helm's ownership entirely after install.

Why not Helm `lookup`?
  Helm `lookup` is evaluated only during `helm install` / `helm upgrade`
  template rendering. On a fresh Sovereign, CNPG bootstraps the Cluster AFTER
  the bp-harbor HelmRelease applies (CNPG takes 30-60 s to reach Ready). The
  first Helm render finds `harbor-pg-app` absent and writes an empty password.
  Flux then marks bp-harbor Ready (disableWait: true); harbor-core crashloops
  quietly. Triggering a manual Helm upgrade after CNPG is ready would fix it,
  but requires operator action. Reflector is event-driven: as soon as
  `harbor-pg-app` is created (or rotated), the watch fires and the Secret is
  updated — no operator action required.

Per docs/INVIOLABLE-PRINCIPLES.md #10 (credential hygiene): no plaintext
credentials appear in this committed template. The reflector copies bytes from
a live cluster Secret.
*/}}
apiVersion: v1
kind: Secret
metadata:
  name: harbor-database-secret
  namespace: {{ .Values.postgres.cluster.namespace | default .Release.Namespace }}
  labels:
    {{- include "bp-harbor.labels" . | nindent 4 }}
  annotations:
    # Helm pre-install hook — Secret is created at install time only.
    # On `helm upgrade`, Helm does not touch this Secret at all, so
    # keys populated by Reflector persist across chart upgrades.
    "helm.sh/hook": "pre-install"
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": "before-hook-creation"
    # Reflector (bp-reflector) copies all keys from harbor-pg-app into this
    # Secret. Harbor upstream reads HARBOR_DATABASE_PASSWORD; CNPG ships
    # `password`. Both land in the Secret via the copy, and Harbor's env
    # binding in the upstream chart uses `existingSecret` which maps
    # harbor.database.external.existingSecret → envFrom secretRef.
    reflector.v1.k8s.emberstack.com/reflects: "{{ .Values.postgres.cluster.namespace | default .Release.Namespace }}/{{ .Values.postgres.cluster.name | default "harbor-pg" }}-app"
    # Helm resource-policy keep — do not delete on helm uninstall (the
    # Secret is independently managed by reflector after initial creation).
    helm.sh/resource-policy: keep
type: Opaque
# NO `data:` block by design — Reflector populates all keys from
# harbor-pg-app on the first SecretWatcher event after CNPG bootstraps
# the source. Helm doesn't track this Secret on upgrade (pre-install
# hook), so subsequent chart upgrades cannot overwrite the data.
